Phishing threats

Recent investigations have uncovered sophisticated phishing campaigns employing multi-stage redirection chains that abuse trusted cloud infrastructure and newly registered domains. One campaign exploits Framer, a no-code web platform, combined with Cloudflare Workers to host deceptive landing pages. These pages utilize HTML redirection smuggling via the Blob API, Web Crypto API for decryption, and anti-debugging techniques to evade detection. Another campaign involves device code phishing targeting OneDrive credentials through three-stage redirections using newly registered domains with randomized alphanumeric strings. Both campaigns employ brand impersonation, custom CAPTCHA challenges, and anti-analysis measures including keyboard shortcut blocking. The threat actors leverage a hybrid infrastructure combining legitimate cloud services with short-lived domains to bypass traditional detection methods.

Signal has also made a security announcement: an automatic key verification feature to complement its safety number system. The post WhatsApp Unveils New Scam Alert Feature appeared first on SecurityWeek .

Files built with the polyglot technique have been showing up more and more in cyberattacks in recent years. They let attackers slip malware past email filters and file scanners, deceive victims in phishing attacks, and complicate incident investigations. To pull this off, attackers deliberately construct a file that a system can interpret as different formats depending on which application opens it. A classic example is a file that can be handled as a PNG image or a ZIP archive. All it takes is changing the file’s extension, or simply using one or another application to open it. Let’s take a look at why it’s even possible to create files like this, which format combinations have turned up in real-world attacks, and how organizations can protect themselves from this threat. Why polyglot files are possible The data formats behind polyglot files are seldom exotic. It all comes down to a clever combination of common formats that happen to be structurally compatible. Polyglots exploit at least one of the following quirks in certain file formats: Most file formats need decoding from the very first byte, but some require to read them from the end. The clearest example is a ZIP archive: a corrupted or missing beginning doesn’t stop applications from reading the file, because all the needed headers actually sit at the end. This lets attackers simply glue two files together — in the example above, a PNG and a ZIP. The beginning reads as a valid PNG image, while the end reads as a valid ZIP archive. Many formats work like Russian matryoshka nesting dolls: despite outwardly having a specific extension matching its intended usage, inside the file is essentially a ZIP archive containing the necessary data. This group includes modern office documents (DOCX/XLSX/PPTX), Android installation packages (APK), Java library files (JAR), and many others. Some formats have no strict structural requirements — or their requirements are loose enough that the application that’s processing the file can locate the fragment it needs even when that fragment isn’t at the beginning. The Polydet GitHub repository describes numerous examples of possible file combinations for building a polyglot. Under the MITRE classification, this technique falls under the Masquerading category ( T1036.008 , Masquerade File Type). Examples of polyglot files in known cyberattacks Publicly available malware campaign analyses reveal all kinds of polyglots. Attackers adapt the entire attack scenario to fit a specific file type combination. The Head Mare group delivered the PhantomPyramid malware as a ZIP attachment. The file consisted of Windows executable code (EXE) with a small ZIP archive glued onto the end. When the victim opened the archive, it contained a file with the extension PDF.LNK, which would then launch that same polyglot attachment — this time as an executable file. In the attack documented by JPCERT , attackers created a file that started as a PDF and was detected as a PDF by most scanners but carried a DOC extension and opened in Office applications as a valid DOC file containing malicious macros. The attacks spreading the StrRAT and Ratty Trojans used a polyglot built from a signed Windows installer package (MSI) with malicious Java code (JAR) tacked onto the end. The StrelaStealer attacks used a polyglot with an HTML extension: a Windows library (DLL) with a decoy HTML document glued onto the end. A shortcut in the archive launched the file twice: once via the start command (the equivalent of a double-click, which opened a browser showing the HTML document), and once via rundll32 (which launched the malicious DLL). In a simulated but elegant attack, researchers joined two ordinary ZIP files together and found that different popular archive tools displayed the combined file differently: some showed only the first archive, some only the second, and some showed both at once as if it were a single archive with shared contents. If the attacker is familiar with the vic…

AI is making phishing, credential theft, and social engineering faster and more efficient, while traditional trust signals such as passwords, MFA, IP reputation, and geolocation become easier to bypass. Specops explains why organizations are increasingly adding device trust to their Zero Trust strategies. [...]

Noteworthy stories that might have slipped under the radar: ban on Chinese data center tech, QuickFox VPN supply chain attack, IEH Corporation mailbox breached via phishing. The post In Other News: AI Slop Limits Apple Bounties, North Carolina Port Attacks, Hackers Target Wall Street appeared first on SecurityWeek .

A phishing campaign is exploiting fears surrounding the recently disclosed COLDCARD wallet vulnerability and suspected $88.6 million Bitcoin theft to trick users into installing ScreenConnect remote access software. [...]

This report discusses how AI-powered phishing techniques have rendered traditional blocklists ineffective by enabling attackers to rapidly create disposable phishing infrastructure and evolving toolkits. It highlights that browser-level, technique-based detection provides a more resilient defense compared to relying on domain blocklists, signatures, or other known-bad indicators. The content emphasizes the challenges in tracking and mitigating phishing attacks that leverage AI to adapt quickly.

The Greatness phishing-as-a-service (PhaaS) platform targets Microsoft 365 accounts using advanced phishing techniques including adversary-in-the-middle and device-code phishing. It spoofs RingCentral emails to bypass email security filters by exploiting whitelisting and safe-sender list trust. Post-compromise, attackers access Microsoft 365 data and services via stolen authentication tokens. The platform is sold to cybercriminals and has been active since at least mid-2022, targeting users in multiple countries. Researchers recommend auditing safe-sender lists and monitoring suspicious MFA-approved sign-ins.

Phishing#phishingUnited States+4

Most phishing campaigns rely on the fact that the victim is afraid to loose "something": money, access to information, ... Many brands have been impersonated by campaigns but I spotted some phishing emails that focus on AI services like ChatGPT.

In this article The CaptiveCrunch campaign Storm-2945 and Midnight Blizzard CaptiveCrunch tradecraft and tooling How to protect against CaptiveCrunch activity Microsoft Defender detections and hunting guidance Indicators of compromise Since early May 2026, Microsoft Threat Intelligence has observed Storm-2945, a sub-cluster of Midnight Blizzard, conducting widespread but targeted traffic manipulation attacks involving hospitality sector networks served by captive portals worldwide. Despite some tactic, technique, and procedure (TTP) similarities to the Forest Blizzard DNS hijacking operation that we publicly disclosed in April 2026, we attribute this campaign, which we call CaptiveCrunch, to Storm-2945. As reported by ReliaQuest on July 23, a portion of this activity leverages doppelganger domains mimicking Microsoft online services to conduct follow-on adversary-in-the-middle (AitM) phishing operations that abuse the device code authentication flow in Microsoft Entra ID. Microsoft Threat Intelligence has also identified active traffic manipulation attacks leading to the delivery of malware on impacted systems. Microsoft has observed Storm-2945 leveraging AI to support a significant portion of these operations. Today, we are sharing our findings on these ongoing intrusions to raise awareness of this threat and enable customers to protect their devices, especially while traveling. We provide our assessment of Storm-2945’s relationship to Midnight Blizzard and analysis of the CaptiveCrunch campaign, detailing the malware and tradecraft used in these operations. We also provide mitigation, detection, and hunting guidance to help organizations identify and defend against Storm-2945 and related activity. Microsoft Threat Intelligence would like to thank our partners at Anthropic and OpenAI for their collaboration and support during this investigation. The CaptiveCrunch campaign Since February 2026, Storm-2945 has conducted AI-augmented operations including targeted device code and OAuth code phishing campaigns leading to Entra device registration and subsequent data collection from Microsoft 365. Since early May 2026, Microsoft Threat Intelligence has observed Storm-2945 manipulating DNS and HTTP traffic from networks served by captive portals to redirect user traffic through actor-controlled infrastructure. Although our investigation into the initial compromise vector for the captive portal networks is ongoing, we have observed notable commonalities in the equipment and management systems used across multiple affected networks. These similarities suggest that the activity might not be limited to isolated compromises of individual venues and could reflect access to shared services within portions of the captive portal ecosystem. Figure 1. Overview of the CaptiveCrunch attack flow As part of the CaptiveCrunch campaign, Storm-2945 has leveraged their AitM position to redirect users through actor-controlled phishing infrastructure and has also delivered malware purporting to be browser or operating system updates in response to automated connectivity checks issued by users’ browsers. Multiple variants have been delivered, including fully-featured Windows remote access trojans (RAT) in compiled Golang, with functionality to conduct system enumeration, collect files and keystrokes, steal credentials and session tokens, conduct audio and video surveillance, monitor for removable media, and provide the threat actor a remote shell on infected systems. The threat actor infrastructure leverages a variety of ClickFix techniques to elicit the user into downloading and executing the malware: Figure 2. ClickFix prompt with manual user instructions Figure 3. ClickFix prompt with additional user instructions after verification failure In addition to variants of malware targeting Windows systems, Microsoft Threat Intelligence is also aware of indications that the threat actor might be targeting Android devices with similar techniques as the ClickFi…

Leveraging legitimate software is one of cybercriminals’ tactics of choice, with remote management tools ranking among their top tools. A recent example involves the remote administration utility ScreenConnect. It’s designed for IT support teams to troubleshoot systems and configure software seamlessly in the background. However, when weaponized by threat actors, ScreenConnect becomes a versatile attack vehicle used to harvest data, deploy malware, and move laterally across corporate networks. During a recent incident detected by Kaspersky Managed Detection and Response , our experts identified an attempt to use ScreenConnect in an attack. This allowed a detailed study of how attackers used this application in a large-scale malware distribution campaign. The following breakdown illustrates the mechanics of ScreenConnect-assisted attacks, and outlines key strategies to defend your organization against them. How ScreenConnect reaches target computers In the campaign analyzed by our experts, the attackers bundled ScreenConnect with legitimate free business software. They established a network of phishing websites to spoof popular tools, including OBS Studio, DS4Windows, DNS Jumper, Glary Utilities, Bandizip, Process Hacker, and others. These rogue websites featured high-quality designs that could be taken for the official pages, making them highly convincing to unsuspecting users. Once the victim clicks the download button for the software, an archive is downloaded to their computer that contains additional files alongside the requested application: A legitimately signed Microsoft executable ( exe ), renamed to match the expected application installer (for example, OBS-Studio-Installer.exe ) A malicious library named res.1033.dll An Assets directory containing installers for both ScreenConnect and the intended application Launching the renamed file disguised as the app installer triggers DLL sideloading of a malicious library. This library silently runs the ScreenConnect installation without restarting the system, while using the standard Windows installer to set up the software the user originally tried to install. The attackers used search engine optimization techniques to drive traffic to their fake websites. As a result, these malicious pages appeared at the top of search results for certain free software utilities on major search engines. Our experts discovered over 90 domain names translated into more than 10 different languages. While most of these websites targeted English, Russian, and Chinese speakers, several domains catered to German, French, Spanish, Arabic, and other regional audiences. A detailed analysis of the IP addresses and associated spoofed domains is available in our technical research article on Securelist, along with full indicators of compromise. Why the attackers exploited ScreenConnect In this campaign, attackers leveraged ScreenConnect to generate and execute malicious scripts on victim machines. These scripts served several key functions: they created exclusions for specific drives, directories, and processes within Windows Defender, disabled the User Account Control (UAC) security mechanism, and delivered and deployed AsyncRAT – a remote access Trojan. To maintain persistence, the scripts configured a Windows scheduled task to run the malicious code at preset intervals. AsyncRAT then established a connection with the attackers’ command-and-control server to receive further instructions. The primary objective of this campaign appears to be gaining unauthorized access to enterprise systems, likely to then resell it on cybercrime marketplaces. How to secure corporate infrastructure Although ScreenConnect in and of itself is a legitimate tool, its presence poses a security risk to corporate environments. Consequently, Kaspersky security solutions detect this application as not-a-virus:HEUR:RemoteAdmin.MSIL.ConnectWise.gen. Security teams should implement the following controls: Enforce strict applicatio…

Three individuals filed a lawsuit against Apple claiming they lost approximately $1.8 million in Bitcoin after downloading a fraudulent Sparrow Wallet app from the Apple App Store. The fake app impersonated the legitimate Sparrow Wallet, which does not have an iOS version, and tricked users into entering their seed phrases, resulting in theft of their cryptocurrency. Despite prior warnings about such fraudulent apps, Apple allegedly failed to adequately monitor and remove these malicious applications. The plaintiffs seek reimbursement, damages, and improvements in Apple's app review and fraud detection processes.

Built a "defensive deception" layer that feeds believable fake data to unauthorized readers — looking for fresh eyes to try to break it (beta) ? Source: https://break-izanami.com

Threat actors are leveraging email addresses exposed in data breaches attributed to the ShinyHunters extortion group to conduct sextortion email scams. These emails demand $2,000 in Bitcoin from recipients, attempting to extort money by threatening to release compromising information. This is a phishing campaign exploiting leaked personal data rather than a software vulnerability.

Device code phishing exploits the OAuth 2.0 device authorization grant, a legitimate authentication feature designed for input-limited devices like smart TVs. Attackers initiate a device-code request with Microsoft, receive a valid code, then trick victims into approving it through social engineering. The victim authenticates on genuine Microsoft pages and completes MFA, but the session tokens are issued to the attacker instead. When targeting the Microsoft Authentication Broker, attackers can register rogue devices and obtain long-lived refresh tokens for persistent access. A recent campaign used sophisticated multi-stage delivery chains involving Google Sites, compromised website redirectors, and fake document-sharing portals. After successful authentication, attackers registered multiple devices, created hidden mailbox rules, and used compromised accounts to send additional phishing emails, all without touching victim endpoints.

A sophisticated adversary-in-the-middle phishing campaign is targeting universities, enterprises, and multinational institutions including EU and UN agencies. Active since May 2026, the operation leverages compromised organizational email accounts to distribute procurement-themed lures that mimic requests for information, bid invitations, and project documentation. Victims are redirected through fake document portals, CAPTCHA verification stages, and cloned authentication pages impersonating Microsoft, OpenGov, and financial institutions. The attacker rotates between multiple AiTM phishing kits including EvilProxy, FlowerStorm, and Kali365 to intercept MFA-protected sessions in real time, capturing session tokens and cookies to establish authenticated access. Rather than using newly registered domains, the actor compromises aged domains that have been dormant for years, injecting PHP files to host phishing infrastructure and evade detection through domain reputation systems.

Authorities in Germany and the U.S. dismantled the central infrastructure of Kratos, a phishing-as-a-service (PhaaS) platform with global reach, and its developer was arrested in Indonesia. [...]

This threat involves a passive phishing campaign that exploits the use of inclusive language in emails by abusing ".es" domain suffixes. Legitimate users include words ending with ".es" as part of inclusive language, but attackers register these domains to redirect victims to fake Microsoft 365 login pages or malicious browser extension installation pages. The campaign is subtle and effective because it targets internal communications and leverages trusted third-party partners, making the malicious links appear legitimate. No specific affected software versions are identified. No known exploits in the wild have been reported.

The Dutch Police announced the arrest of multiple individuals suspected of being part of an international investment fraud scheme estimated to have tens of thousands of victims. [...]

A sophisticated multi-stage phishing operation has been active since April 2025, systematically exploiting legitimate SaaS platforms and cloud services to steal corporate credentials. The campaign utilizes 232 phishing domains and 80 command-and-control servers, primarily impersonating human resources consulting firms, with Robert Half Inc. and Aquent LLC representing 50% of targeted brands. Attackers leverage legitimate platforms like Salesforce, SendGrid, and Zoho for email delivery, directing victims to fake Calendly interview pages that mimic real recruiter identities. The operation deploys an adversary-in-the-middle toolkit using browser-in-the-box techniques to create replica Google sign-in pages, capable of harvesting credentials and bypassing MFA through email, SMS, Google Authenticator, and prompt notifications. The campaign specifically targets corporate email accounts, filtering out personal providers, with stolen data exfiltrated to Render-hosted servers and Telegram bots.